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REMARKS/ARGUMENTS 

Favorable reconsideration of this application as presently amended and in light of the 
following discussion is respectfully requested. 

Claims 16-24 and 26-30 are pending in the present application. Claims 1-15 and 25 
are previously cancelled, and Claims 16 and 28 are amended by the present amendment. 
Support for amendments to the claims can be found in the disclosure as originally filed, at 
least in paragraphs 0022, 0023 and 0070-0073. Thus, no new matter is added. 

In the outstanding Action, Claims 16 and 28 were rejected under 35 U.S.C. §112, first 
paragraph, as failing to comply with the written description requirement; Claims 16-19, 21, 
22, 24-26 and 28 were rejected under 35 U.S.C. § 103(a) as unpatentable over Kanno et al. 
(U.S. Pat. Pub. No. 2004/0064738, herein "K^mo") in view of Bang et al. (KR Pat Pub No. 
10-2004-0036228, herein " Bang "): Claim 20 was rejected under 35 U.S.C, § 103(a) as 
unpatentable over Kanno and Bang in view of loele et al. (U.S. Pat. No. 7,007,229, herein 
"loele"); Claim 23 was rejected under 35 U.S.C. § 103(a) as unpatentable over Kanno and 
Bang in view of Patrick et al. (U.S. Pat. No. 7,310,684, herein " Patrick "): and Claim 27 was 
rejected under 35 U.S.C. § 103(a) as unpatentable over Kanno and Bang in view of Costa et 
al (U.S. Pat. No. 2007/0006314, herein "Costa"). 

With respect to the rejection of Claims 16 and 28 under 35 U.S.C. §112, first 
paragraph, as failing to comply with the written description requirement, Applicants 
respectfully traverse this rejection. Specifically, the portions of the disclosure related to the 
performance measuring device clearly illustrate that the Applicants had possession of the 
claimed invention at the time the Application was filed. 

Specifically, MPEP §2163.02 states that the "objective standard for determining 
compliance with the written description requirement is, "does the description clearly allow 
persons of ordinary skill in the art to recognize that he or she invented what is claimed." In re 
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Gosteli, 872 F.2d 1008, 1012, 10 USPQ2d 1614, 1618 (Fed. Cir. 1989)." In the present case, 
it is clear from the present disclosure in paragraphs 0008, 0020 and 0022 that the 
performance measuring device remotely measures response performance of the 
communication device based on a performance abnormality detection condition including a 
response time from transmission of a response request message to the communication device, 
to reception of a response message corresponding to the response request message. Thus, 
Applicants respectfully submit that written description support for the performance 
measuring device feature in Claims 16 and 28 clearly exists. 

Accordingly, Applicants respectfully request that the rejection of Claims 16 and 28 
under 35 U.S.C. §112, first paragraph, be withdrawn. 

Addressing now the rejection of Claims 16-19, 21, 22, 24-26 and 28 under 35 U.S.C. 
§ 103(a) as unpatentable over Kanno and Bang , Applicants respectfully traverse this assertion. 

Amended Claim 16 recites, 

a monitoring device that monitors each packet 
transmitted to the communication device and includes a traffic 
abnormality detecting unit that detects traffic abnormality 
information indicating an abnormality of traffic based on 
packets transmitted to the communication device; 

a performance measuring device that measures response 
performance of the communication device based on a 
performance abnormality detection condition including a 
response time from transmission of a response request message 
to the communication device, to reception of a response 
message corresponding to the response request message, the 
performance measuring device being separate fi"om the 
communication device and the monitoring device, the 
performance measuring device including a performance 
abnormality detecting unit that detects performance 
abnormality information indicating an abnormality of 
throughput of the communication device; and 

an attack determining device that is connected to and 
performs communication with the monitoring device and the 
performance measuring device, 

the attack determining device including an effects 
determining unit that determines whether the communication 
device has received the denial-of-service attack, using both the 
traffic abnormality information and the performance 
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abnormality information and the effects determining unit 
determining that the communication device has received the 
denial-of-service attack, when it is determined that one of the 
traffic abnormality information and the performance 
abnormality information causes an occurrence of one of the 
traffic abnormality information and the performance 
abnormality information based on an abnormality occurrence 
time included in the traffic abnormality information and the 
performance abnormahty information. 

Claim 28 recites a corresponding method claim. 

Kanno describes a server computer protection apparatus which protects a server 

against DoS attacks by counting the number of incoming data requests and the number of 

outgoing data supplies and cutting off the data requests when an imbalance between the two 

is too high. 

However, Kanno does not describe or suggest, among other things, a performance 
measuring device that remotely measures response performance of the communication device 
based on a performance abnormality detection condition including a response time from 
transmission of a response request message to the communication device, to reception of a 
response message corresponding to the response request message, the performance measuring 
device being separate from the communication device and the monitoring device, the 
performance measuring device including a performance abnormality detecting unit that 
detects performance abnormality information indicating an abnormality of throughput of the 
communication device, as is recited in Claim 16. 

The outstanding Action asserts on pages 4-5 that "correspondence between a data 
request and a certain data response by transferring a data request via a "data request transfer 
unit" can be considered as corresponding to the features of the performance measuring device 
recited in Claim 16, Applicants respectfully traverse this assertion as erroneous. 

Specifically, Applicants note that the outstanding Action has cited the same element 
"server protection apparatus" 103 and intemal portions 204, 205, etc. as corresponding to 
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both the monitoring device and the performance measuring device. However, Claim 16 
clearly recites that the performing measuring device is separate from the communication 
device and the monitoring device. 

Moreover, Applicants note that the interaction between the response probability 
calculation unit 205 and the data request transfer unit 202 has nothing to do with measuring 
response performance of the communication device based on a performance abnormality 
detection condition including a response time from transmission of a response request 
message to the communication device, to reception of a response message corresponding to 
the response request message. 

The "server protection apparatus" 103 of Kanno does not measure response 
performance of a communication device based on a performance abnormaHty detection 
condition. Instead this device merely intercepts data requests to the server and either allows 
or denies the request based on the correspondence between requests and responses. 

Thus, Kanno cannot be asserted as describing the performance measuring device 
recited in Claim 16. 

Moreover, as is acknowledged in the outstanding Action on page 5, Kanno does not 
describe or suggest an attack determining device including an effects determining unit that 
determines whether the communication device is a recipient of the denial-of-service attack, 
using both the traffic abnormality information and the performance abnormality information. 

Nevertheless, the outstanding Action cites Bang as curing the deficiencies of Kanno 
with regard to the claimed invention. 

Bang describes a system for detecting harmful traffic, tracing the source of the 
harmful traffic and cutting off the source of the harmful traffic. Specifically, Bang describes 
monitoring changes in traffic flow. When the change in traffic flow exceeds a certain 
threshold, the system detects the source of the traffic and cuts it off. 
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However, Bang never describes or suggests a performance measuring device that 
measures response performance of the communication device based on a performance 
abnormality detection condition including a response time from transmission of a response 
request message to the communication device, to reception of a response message 
corresponding to the response request message, the performance measuring device being 
separate from the communication device and the monitoring device, the performance 
measuring device including a performance abnormality detecting unit that detects 
performance abnormality information indicating an abnormality of throughput of the 
communication device, as is recited in Claim 16. 

Further, Bang never describes or suggests an attack determining device including an 
effects determining unit that determines whether the communication device is a recipient of 
the denial-of-service attack, using both the traffic abnormality information and the 
performance abnormality information. 

The outstanding Action asserts on page 6 that Bang cures the deficiencies of Kanno 
with regard to the attack determining device recited in Claim 16. 

In particular, the outstanding Action asserts on page 6 that because Banig describes a 
separate "monitoring unit" 700 and "harmful traffic tracing unit" 720 then the attack 
determining device and particularly the fact that that attack determining device uses both the 
traffic abnormality information and the performance abnormality information to determine 
whether the communication device is a recipient of the denial-of-service attack, is rendered 
obvious. Applicants respectfully traverse this assertion. 

Specifically, Applicants note that the "harmful traffic tracing unit" 720 cannot be 
asserted as providing the performance abnormality information as this element in Bang is 
described as detecting a source IP address of computer which is determined as having a 
traffic component exceeding a threshold and cutting off the traffic after having analyzed this 
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traffic. Further, the monitoring unit also cannot be asserted as providing performance 
abnormality information as this element is simply monitoring for changes in traffic flow. 

Thus, the combination of Kanno and Bang cannot be asserted as describing the 
performance measuring device recited in Claim 16. 

Accordingly, Applicants respectfully submit that Claim 16 and similarly Claim 28, 
and claims depending therefi*om, patentably distinguish over Kanno and Bang considered 
individually or in combination. 

Consequently, in light of the above discussion and in view of the present amendment, 
the present application is believed to be in condition for allowance and an early and favorable 
action to that effect is respectfully requested. 



Respectfully submitted. 
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